REMARKS 



Summary 

In the Office Action, claims 1-22 stand rejected, claims 1 1 and 21 stand objected 
to, and the Specification stands objected to. In this response, claims 1, 2, 5, 6, 10-12, 
17, 19, 21, and 22 are amended, claim 9 is cancelled, and claims 23-27 are added. In 
addition, the Specification has been amended. 

Objections to the Specification 

The Specification stands objected to for failing to include a brief summary of the 
invention, and the examiner suggested the inclusion thereof. However, inclusion 
thereof is not so required, and Applicant does not wish to include a brief summary of the 
invention in the Specification. Accordingly, Applicant has amended the Specification to 
include a section heading "Brief Summary of the Invention" with the phrase "Not 
Applicable" following the section heading. 

Claim Rejections under 35 U.S.C. 5 101 

Claims 19-22 stand rejected under 35 U.S.C. § 101 as being directed to non- 
statutory subject matter. In particular, it is queried in the Office Action whether the 
claims are directed merely to functional descriptive material per se that is not tied to a 
technological art, environment, or machine, which would result in a practical application 
producing a concrete, useful, and tangible result. 

Applicant respectfully asserts that the claims as originally filed in fact tied to a 
technological art, environment, or machine, which would result in a practical application 
producing a concrete, useful, and tangible result, due to the inclusion of the machine- 
accessible media. Nonetheless, in the interest of expediting prosecution of this 
application, Applicant has amended claims 19 and 21 to clarify the language. In 
particular, claims 19 and 21 have been amended to more clearly claim a machine- 
accessible storage medium , and data stored on the storage medium which results in the 
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performance of network monitoring. Accordingly, claims 19 and 21 , and claims 20 and 
22 depending therefrom, now stand in condition for allowance. 

Claim Rejections under 35 U.S.C. 5 102 

Claims 1-8, 11, 14-16, and 19-21 stand rejected under 35 U.S.C. § 102(b) as 
being anticipated by U.S. Publication No. 2002/0120853 of Tyree (hereinafter "Tyree"). 
In this response, independent claims 1 , 11, 19, and 21 are amended and Applicant 
respectfully asserts the claims now stand in condition of allowance. Accordingly, claims 
2-8, 14-16, 20, and 22, which depend either directly or indirectly from one of 
independent claims 1 , 11, 19, and 21 , also stand in condition of allowance. 

Claim 1 , as amended, is directed to a method for establishing a network 
connection between a first machine and a second machine, comprising: 

determining suspicious network activity on the network; 

if suspicious network activity is determined, establishing a first 
communication session between the first machine and the monitoring 
device; 

after establishing the first communication session, receiving by the 
monitoring device a data access request from the first machine; 

storing the data access request ; 

sending a test to the first machine, the test having at least one 
characteristic making the test resistant to automatic answering of the test; 
and 

after a valid response to the test is received, forwarding the data 
access request from the monitoring device to the second machine for 
establishing a second communication session between the first machine 
and a second machine . 

Accordingly, the claimed method is directed to storing a data access request from a first 
machine, and then forwarding the data access request to the second machine after a 
valid response to the test is received for establishing a communication session 
therebetween. 
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In contrast, Tyree fails to disclose the invention as claimed in claim 1 . Tyree 
discloses a method for controlling access to resources by allowing or disallowing access 
to the resources depending on whether an entity is determined to be an "intelligent 
being." See, e.g., Tyree, Abstract; If [0083]; Fig. 2. Thus, rather than storing a data 
access request from a first machine, and then forwarding the data access request from 
a monitoring device to a second machine if a valid response to a test is received, Tyree 
simply allows a user access to a server if authentication is passed. See Tyree, Fig. 2, 
at 216 and 218. Accordingly, Tyree cannot be said to anticipate the invention of claim 
1. 

Claims 11, 19, and 21 include limitations similar to the limitations set forth in 
claim 1 . Accordingly, said claims also are allowable over Tyree for at least the same 
reasons. 

Claims 2-8, 14-16, 20, and 22 depend from one of claims 1 , 1 1 , 19, and 21 , 
either directly or via an intervening claim. Accordingly, said claims also are allowable 
over Tyree for at least the same reasons. 

Claim Rejections under 35 U.S.C. § 103 

Claims 9, 10, 12, 13, 17, 18, and 22 stand rejected under 35 U.S.C. § 103 as 
being unpatentable over a combination of Tyree and U.S. Patent No. 6,779,033 issued 
to Watson et al. (hereinafter "Watson"). 

Claim 9 has been cancelled thereby rendering moot the rejection thereof. 

As discussed herein, independent claims 1,11, and 21 are allowable over the 
Tyree. Claims 10,12,13,17,18, and 22 depend from one of claims 1,11, and 21 , 
either directly or via an intervening claim. Accordingly, claims 10, 12, 13, 17, 18, and 22 
also are allowable over Tyree for at least the same reasons claim 1,11, and 21 are 
allowable. 

Watson fails to remedy the deficiency of the prior art. Specifically, Watson fails 
to disclose storing a data access request from a first machine, and then forwarding the 
data access request to the second machine after a valid response to a test is received. 
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At best, Watson discloses forwarding a session request from a client to a server through 
an intermediary for establishing a communication session between a client and a 
server. See, e.g., Watson, 3:19-29; 8:29-40. However, nowhere does Watson disclose 
storing a data access request (e.g., a GET request) from a first machine, and then 
forwarding the data access request to a second machine after a valid response to a test 
is received. Accordingly, Watson cannot be said to remedy the deficiency of Tyree. 

Accordingly, claims 10, 12, 13, 17, 18, and 22 are allowable over Tyree even if 
combined with Watson. 

New Claims 

New claims 23-27 have been added herewith, and as such, are not included 
among the rejections set forth in the Office Action. Nonetheless, Applicant would like to 
note that the newly added claims are in condition of allowance over either one or both of 
Tyree and Watson. 

With respect to claims 23 and 24, said claims are directed to determining 
suspicious network activity by tracking by a monitoring device a number of attempts to 
establish communication sessions with a machine; and if the number of attempts 
exceeds a predetermined threshold per a predetermined time period, modifying a state 
of the monitoring device from a normal mode of operation to a safe mode of operation. 
Neither of Tyree and Watson make such a disclosure. Although Tyree discloses a 
distributed-denial-of-service attack identifier 330, nowhere does Tyree disclose tracking 
by a monitoring device a number of attempts to establish communication sessions with 
a machine; and if the number of attempts exceeds a predetermined threshold per a 
predetermined time period, modifying a state of the monitoring device from a normal 
mode of operation to a safe mode of operation. 

With respect to claim 25, said claim is directed to after a valid response to the 
test is received and the second communication session is established, facilitating by the 
monitoring device establishing of a third communication session directly between the 
first machine and the second machine. Neither Tyree nor Watson make such a 
disclosure. Not only does Tyree fail to disclose establishing of a second communication 
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session, but Tyree also fails to disclose facilitating by a monitoring device establishing 
of a third communication session. 

Further, Watson similarly fails to disclose the limitations of claim 25. Similarly to 
Tyree, Watson fails to disclose facilitating by a monitoring device establishing of a third 
communication session directly between the first machine and the second machine. At 
best, Watson discloses posing as an intermediary for all communications between a 
client and a server. See, e.g., Watson, 3:19-29; 8:29-40. Thus, Watson cannot be said 
to disclose direct communication between a first machine (e.g., a client) and a second 
machine (e.g., a server). 

Accordingly, the new claims are allowable over one or both of Tyree and Watson. 

CONCLUSION 

In view of the foregoing, Applicants respectfully submit that the pending claims 
are in condition of allowance. Thus, entry of the offered amendments and early 
issuance of Notice of Allowance is respectfully requested. 

The Commissioner is hereby authorized to charge shortages or credit 
overpayments to Deposit Account No. 500393. 

Schwabe, Williamson & Wyatt, P.C. 

Date: 04/06/2007 by: /Angela M. Saqalewicz/ 

Angela M. Sagalewicz 
Reg. No.: 56,113 

Schwabe, Williamson & Wyatt, P.C. 
Pacwest Center, Suites 1600-1900 
1211 SW Fifth Avenue 
Portland, Oregon 97222 
Telephone: 503-796-3765 (direct) 
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